The self-custody checklist

The moves that get your Bitcoin out of someone else’s hands and into your own.

• Understand hot vs cold before you move anything A hot wallet is connected to the internet — fine for spending money. A cold wallet keeps the keys offline — that’s where savings belong. Getting this straight first stops the most common beginner mistake. Read the lesson → Rule 03 · Savings never go online
• Choose your collaborative custodian The service holds one key of your multisig — you hold the rest, and they can never move your coins alone. Choose the service before the hardware: each one lists the devices it supports, and some send you one. Compare them on recovery terms and whether you could rebuild the wallet without them. See the guide →
• Get a hardware wallet A device from our cold-storage tier — Bitcoin-only firmware available, its own screen, offline signing. Buy direct from the maker and check the tamper seal. See the guide → Rule 06 · Buy it new and direct
• Use a different maker for each of your three keys The cheapest meaningful upgrade in all of self-custody. Three identical devices share one point of failure — a flaw in that brand hits every key at once, and the multisig protects you from nothing it was bought for. Three different makers means any one brand’s problem can only ever reach one of your three keys. Read the lesson →
• Use a different maker for each of your two keys You hold two of the three keys, and two is enough to spend. So if both of your devices come from the same maker, one flaw in that brand reaches a spending quorum on its own — the service’s key never comes into it. Two different makers, and any one brand’s problem can only ever reach one key. Read the lesson →
• Install the maker’s wallet app Your hardware wallet pairs with an app on your computer or phone — that’s where you’ll see balances and prepare the payments the device signs. Get it from the maker’s official site only, typed by hand, never from a search result or an ad: fake copies of these apps exist, and they are built to steal. Read the lesson →
• Generate a fresh seed — and add your own randomness Power the device on and follow the maker’s official start page — the address printed in the box or on their site, not a link someone sent you. Set a PIN when it asks, then let the device create the seed in front of you: it shows the words on its own screen, and you copy them down by hand. Never use pre-set words, and never type the words into a computer or phone. Where your device allows it, add your own dice throws to the randomness it generates — it takes a few minutes, it cannot make the result worse, and it removes the one part of your setup you otherwise have to take on trust. Read the lesson → Rule 06 · Buy it new and direct
• Roll your passphrase — don’t invent one The secret “25th word” that opens your real wallet; the seed alone opens a decoy. It can’t be reset, nothing rate-limits a guess, and there is no “wrong passphrase” error — mistype it and a different, empty, perfectly valid wallet opens instead. So don’t think one up: roll it off the same word table you used for the seed. Six words is the floor, eight if this is protecting savings. Plain ASCII, no space at either end, and capitals count. Read the lesson →
• Set a PIN on the device The PIN stops someone who physically grabs the device from using it. It does NOT protect the seed — anyone holding your recovery words needs no PIN at all, which is why the backup is the thing that must never be seen. Set one anyway; it is free and it closes the easiest theft there is. Read the lesson →
• Verify every address on the device’s own screen The device’s screen is the one display malware can’t rewrite — your computer will show a swapped address without blinking. Read the address on the device, confirm it, then approve — every single time. Read the lesson →
• Send a small test amount to your new wallet Move a little off the exchange — enough to prove the route works, small enough that a mistake costs nothing. Verify the receive address on the device’s own screen first, then confirm it arrives. The rest of your Bitcoin stays put until your backup is proven. Read the lesson → Rule 01 · Not your keys, not your coins

The backup IS the wallet. This is the part people get wrong, and it’s the part that loses coins.

• Write the seed on paper, check it, then move it to metal Copy the words by hand and check them against the device. Paper is fine for today; get it onto metal before the wallet holds anything you would miss, and keep each copy in a genuinely separate place. No photos, no cloud, ever. See the guide → Rule 07 · Never digital
• Back up the passphrase — separately from the seed The single most documented way people lose passphrase-protected Bitcoin: they memorise it, never write it down, then forget it or die. The seed is backed up so the wallet LOOKS recoverable — it isn’t. Back up the passphrase as carefully as the seed, in a different place. Read the lesson →
• Back up the wallet descriptor Multisig needs one thing single-sig doesn’t: the descriptor — the small file describing how your keys combine. Without it your keys alone can’t rebuild the wallet. It holds no secrets, so back it up everywhere your keys are. Read the lesson →
• Put your keys in genuinely different places Multisig only removes the single point of failure if the keys can’t all be lost or seized together. A common split: home, a safe-deposit box, and a trusted person or second property. Read the lesson →

A backup you haven’t tested is a hope. Do this before you move real money.

• Prove recovery works before funding Wipe the device and restore from your backup with a tiny amount. A backup you haven’t tested is a hope. Read the lesson → Rule 08 · Test before you fund
• Restore with the passphrase, not just the seed Restoring the seed alone lands you in the decoy wallet — and everything will look fine. Confirm the passphrase restores the wallet that actually holds your coins. Try the demo →
• Rehearse a spend with your backup keys Prove you can sign with the keys you’d actually reach for in an emergency — not just the two sitting on your desk. Do it on a small amount before the wallet holds anything real. Read the lesson →
• Confirm you can recover WITHOUT the service The whole point of collaborative custody is that the service is a convenience, not a dependency. Make sure you hold enough keys — and the descriptor — to rebuild the wallet if they vanish tomorrow. See the guide →
• Move the rest — now that the backup is proven Your backup exists, lives in more than one place, and has restored the wallet in a real test. Now the rest of your Bitcoin can follow the test amount. Verify the receive address on the device’s screen each time, and move it in a couple of pieces rather than one blind step. Read the lesson → Rule 01 · Not your keys, not your coins

Once your coins are cold, close the everyday gaps — and leave a plan someone else could follow.

• Learn the daily-safety habits Treat every unexpected message, call, or “support” contact as a trap until proven otherwise. Nobody legitimate ever needs your seed words — the demand itself is the proof. Read the lesson → Rule 09 · Requiring your words = theft
• Keep a low physical profile Don’t advertise that you hold Bitcoin. Keep amounts vague, skip the branded gear, and reduce where your name is tied to it. Read the lesson → Rule 10 · Talk about Bitcoin, not yours
• Address your privacy Use a fresh address every time, be careful about combining coins, and reduce KYC exposure (the ID checks exchanges make you pass, which tie your name to your coins). Read the lesson → Rule 11 · A fresh address every time
• Write a recovery kit and inheritance plan A plain-language document your future self and your heirs can follow — without ever writing the seed words in it. Read the lesson → Rule 12 · Leave a plan they can follow
• Make sure the right person knows the kit exists A perfect recovery kit nobody knows about is no plan at all. They don’t need the seed or the passphrase — only to know the kit exists and where to find it. Read the lesson →
• Right-size your setup Check where you belong on the ladder — our map of setups from simplest to most advanced. Most people are safest at the lower rungs; climb only for a real reason. Read the lesson → Rule 05 · Simplest setup that covers you

A setup is a practice, not a one-time event. Once a year, in one sitting:

• Re-test a backup Do a quick signed-message check (a built-in test that proves your keys still work, without moving any money), or a full wipe-and-restore if something has changed. Read the lesson → Rule 08 · Test before you fund
• Update device firmware Apply the maker’s security updates from their official app only.
• Review your recovery kit and heirs Are the instructions still accurate? Do the right people still know where to look? Read the lesson →
• Confirm your backup locations Has anything moved, flooded, or changed hands? Fix it while you remember. Read the lesson →
• Reconsider your rung If your holdings have grown a lot, re-check whether it’s time to move up the ladder. Read the lesson →